Truly Random Number Generation Based on Measurement of Phase Noise of Laser 
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We present a simple approach to realize truly random number generation based on measurement of 
the phase noise of a single mode vertical cavity surface emitting laser (VCSEL). The true randomness 
of the quantum phase noise originates from the spontaneous emission of photons and the random 
bit generation rate is ultimately limited only by the laser linewidth. With the final bit generation 
rate of 20 Mbit/s, the physically guaranteed truly random bit sequence passes the three standard 
random tests. Moreover, for the first time, a continuously generated random bit sequence up to 14 
Gbit is verified by two additional criteria for its true randomness. 

PACS numbers: 05.40.-a, 42.55.Px, 42.55.Ah 



Random number generator (RNG) has wide applica- 
tions in statistical sampling [1], computer simulations 2], 
randomized algorithm Q and cryptography Tradi- 
tionally, pseudorandom number generator (PRNG) based 
on computational algorithms is adopted to generate ran- 
dom bits and is competent in many fields. However, it 
cannot produce truly random (unpredictable and irre- 
producible) bit sequence, and so may result in potential 
dangers in security related applications, say, in quantum 
cryptography [f| . Actually, the unconditional security of 
quantum key distribution can ONLY be guaranteed when 
a truly random number generator (TRNG), based on 
quantum mechanical process instead of the intractabil- 
ity assumption with classical algorithms [6j, is available. 

Distinct from PRNG, a TRNG can only be realized by 
a physical way, instead of an algorithm-based way; how- 
ever, a physical way does not sufficiently guarantee the 
true randomness. The physically random processes, such 
as radioactive decay [7|, electric noise in circuits [8||, fre- 
quency jitter of electric oscillator [9j|, and those based on 
laser (photon) emission/detection [1CH12| |. can ensure the 
inability of pre-estimation on random numbers and so can 
be adopted as candidates to implement TRNG. In partic- 
ular, those based on the detection of laser field attracted 
tremendous interests in recent decade. Recently, chaotic 
laser, with ultra-wide bandwidth, becomes a promising 
candidate for GHz random bit generation [lH, Q] • How- 
ever, since the signal of chaotic laser has a periodicity 
originated from the photon round trip time, it is es- 
sentially NOT a truly random source. Also, we know, 
the chaotic systems are deterministic that looks random 
but without inherent randomness [HI [njj]. Hence, we 
coin this kind of physically-based, rather than algorithm- 
based, pseudo RNG as physically pseudorandom number 
generator (PPRNG). Thus, the true randomness guar- 
anteed by physical principle(s), instead of its generation 
rate, should be firstly pursued for a TRNG, otherwise, 
even though with ultrahigh rate, it is just a pseudo RNG; 
on the other hand, the TRNGs based on the above- 
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FIG. 1: (color online). Schematic setup of TRNG based on 
the phase noise measurement using delayed self-homodyne 
method. BS, beam splitter; APD, avalanche photodetector 
with the low (high) cutoff frequency of 50 kHz (1 GHz). ADC, 
8-bit binary analog-digital-converter working at 40 MHz. 



mentioned physical mechanisms |7H12j cannot offer the 
bit generation rate as high as PPRNG based on chaotic 
lasers [13l . Il4| . So far, the typical maximal random bit 
generation rate is around 10 Mbit/s for electric oscillator 
jitter measurement scheme [9] and 4 Mbit/s for photon 
detection scheme [ll|. Also, it should be noted that in 
these schemes, the statistical bias and correlation for long 
random bit sequence were not investigated. 

In this Letter, we propose a new and simple TRNG 
scheme based on the true randomness of the quantum 
phase noise, which is a Gaussian random variable [l7l[l8j |. 
of a single-mode vertical cavity surface emitting laser 
(VCSEL). The true randomness of the quantum phase 
noise is originated from the random nature of sponta- 
neous emission and is guaranteed by physical principle. 
It will, in the following, be shown that the random bit 
generation rate of this TRNG is ultimately limited only 
by the laser linewidth. In our experiment, the high final 
bit generation rate reaches 20 Mbit/s with guaranteed 
true randomness. Further, the true randomness is not 
only guaranteed in physical principle and standard tests, 
but is also verified by two additional criteria (statistical 
bias and correlation) for the long random bit sequence 
up to 14 Gbit, for the first time. 

The schematic setup is shown in Fig. Q] and the 
delayed self-homodyne method is used to measure the 
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FIG. 2: (color online), (a) The quantum phase (classical 
amplitude) noise of the laser field is observed with (without) 
the beat signal. The inset is the power spectral density of the 
beat signal, (b) Autocorrelation function of the beat signal 
versus time interval. In our experiment, the sampling interval 
of 25 ns (40 MHz sampling rate) is chosen. 



phase noise of the VCSEL. In this case, the output al- 
ternative current (AC) voltage of the avalanche pho- 
todetector (APD) detecting the beat signal is V p h oc 
AC[/ beat ] = 2S(t)S{t + t) cos[0(t) - 4>{t + r)], where the 
amplitude fluctuations of S (t) and S{t + r) are negligi- 
ble compared to the phase fluctuation corresponding to 
cos[(j>(t)-(j)(t + T)] [IlHii- When the delay time is much 
longer than the coherence time of laser (i.e., r 3> T co h)i 
the phase difference A<f)(t) — <p(t) — <p(t + r) is a Gaussian 
random variable, and thus the autocorrelation function 
of the electric field of the laser is eliminated i.e., 



(E*{t)E(t + r)> cx exp(-\T\/T coh ) -> 0, 



(1) 



where r coh = (7rAi/ /aser ) 1 [l8(, and Aui aser is the laser 
linewidth. This indicates that the electric field ampli- 
tudes of the laser at different time are mutually indepen- 
dent, if time interval is much longer than the coherence 
time of the laser. Further, similar calculation procedure 
can be applied to obtain the autocorrelation function 
of the beat signal [E beat (t)] as {El eat {t)E beat {t + At)), 
where At is the sampling interval for original random 



FIG. 3: (color online). A 200 ns trace of the APD-detected 
voltages of the beat signal (small black dots) is recorded at 
10 GHz, while the random signal (big red dots) is sampled 
at 40 MHz rate (25 ns interval). The final random bit is 
obtained from the least significant bit (LSB, i.e., its parity) of 
a sequence of 8-bit binary derivatives obtained by performing 
subtraction between two consecutive sampled voltages (shown 
in the bottom strip). 



bit generation. Using E beat (t) = E(t) + E(t + r) and 
Eq. ([T]), it is evident that when the sampling time At 
meets At 3> t + r co h, the autocorrelation of the beat 
signal will also be eliminated. Thus, the bits extracted 
from the beat signal are mutually independent and can 
be adopted to implement TRNG. 

In experiment (Fig. [I}, a 795 nm VCSEL laser works 
at 1.5 mA, a little above the threshold current 1.0 mA. 
The laser linewidth Avi aser — 200 MHz (r co h — 1.59 ns) 
of laser is inversely proportional to the laser power, while 
the classical noises are independent on it [25j . Due to 
working just above threshold, the quantum phase noise 
of laser dominates over the classical amplitude noise to 
ensure the true randomness of generated bits. The delay 
time r is set to be about 10 ns (corresponds to 3.0 m 
space delay) in order to fulfill r 3> r co h- So, the self- 
homodyne method with delay time r is used to obtain the 
beat signal with 3 dB linewidth of 400 MHz (detected by 
an APD) and its power spectral density is shown in the 
inset of Fig. [5] (a). It can be seen, from Fig. [5] (a), that 
the classical amplitude fluctuation is negligible compared 
to the quantum phase fluctuation within 200 MHz (the 
gap is about 20 dB). Using Wiener-Khintchine theorem 

lliii.e., 



Rbeat(t) 



+oo 



-Pheat(w) exp(-iu}t)du, 



(2) 



the autocorrelation function [Rbeat(t)] of the beat signal 
is obtained from the power spectral density of the phase 
noise [Pbeatiw) in Fig. [21(a)] and illustrated in Fig. [U(b). 
It can be seen from Fig. [5] (b) that the autocorrelation 
of the beat signal can be ignored, if the sampling interval 
is set as At 3> r + t co ^. In our experiment, the sampling 
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FIG. 4: (color online), (a) The statistical bias (B) of the final 
random bit sequence. It can be seen that B < 1.5/y/N always 
holds and converges to zero for large bit sequence, where 
is the probability of ones in sequence, (b) The absolute value 
of the first-order correlation coefficient |ai| of the final random 
bit sequence. It can be seen that [ai| < S/^/N always holds 
and | a.1 1 converges to zero for large bit sequence. 



rate is chosen as 40 MHz accordingly, i.e., At = 25 ns, so 
the bits extracted from these sampled voltages are mutu- 
ally independent. These sampled voltages are digitized 
by an 8-bit analog-digital-converter (ADC) shown as the 
red dots in Fig. [31 and further we have confirmed that the 
distribution of voltages is symmetric. Hence, we take the 
least significant bit (LSB) of each sampled 8-bit voltage 
as the original random bit, i.e., the parity of this 8-bit bi- 
nary number, which represents whether the voltage falls 
in an even or odd bin of the total 256 bins. For the non- 
ideal distribution of these voltages, the probability of all 
the even and odd bins of the total 256 bins are not per- 
fectly equal, and the bit sequence shows a statistical bias 
of the order of 10~ 3 . For much lower bias, we perform 
a subtraction between two consecutive sampled voltages 
to obtain a sequence of N/2 8-bit binary derivatives as 
Va - Vi,T4 - V 3 , . . . ,V N - V N -i, where N is the total 
number of the original sampled voltages. In this process, 
each voltage is used only once, and thus no correlation 
is introduced. After that, we adopt the LSB of the 8- 
bit binary derivatives to generate the final random bits. 



TABLE I: Results of Diehard statistical test suite. Data sam- 
ple containing 100 Mbits is used for the Diehard test. For the 
cases of multiple p- values, a Kolmogorov-Smirnov (KS) test is 
used to obtain a final P-value, which measures the uniformity 
of the multiple p-values. The test is considered successful if 
all final P-values satisfy 0.01 < P < 0.99. 



Statistical test 


P-value 




Result 


Birthday spacings 





910531 


[KS] 


Success 


Overlapping permutations 





294899 




Success 


Ranks of 31 x 31 matrices 





322213 




Success 


Ranks of 32 x 32 matrices 





482575 




Success 


Ranks of 6 x 8 matrices 





749427 


[KS] 


Success 


Monkey tests on 20-bit words 





019887 


[KS] 


Success 


Monkey test OPSO 





079864 


[KS] 


Success 


Monkey test OQSO 





725649 


[KS] 

L J 


Success 


Monkey test DNA 





293543 


[KS] 

L J 


Success 


Count l's in stream of bytes 





244463 




Success 


Count l's in specific bytes 





062188 


[KS] 


Success 


Parking lot test 





806898 


[KS] 


Success 


Minimum distance test 





326209 


[KS] 


Success 


Random spheres test 





902946 


[KS] 


Success 


Squeeze test 





815876 


[KS] 


Success 


Overlapping sums test 





806025 


[KS] 


Success 


Runs test (up) 





817356 




Success 


Runs test (down) 





805323 




Success 


Craps test No. of wins 





502035 




Success 


Craps test throws/game 





403322 




Success 



Therefore, we directly obtained the final random bit at 
generation rate of 20 Mbit/s with a software-based post- 
processing. Note that, the post-processing enhances the 
performance of the random bits sequence by lowering the 
statistical bias while not introducing any additional cor- 
relations. For a TRNG, both the statistical bias and the 
absolute value of the first-order correlation coefficient of 
the final random bit sequence are expected to be smaller 
than three standard deviations (3<7i = 1.5/%/A" for sta- 
tistical bias [Fig. Ufa)], and 3(J2 = 3/yN for correlation 
coefficient [Fig. fflb)]) with the probability of 99.7%. In 
our case, both criteria are well satisfied for the final ran- 
dom bit sequence up to 14 Gbit. 

We continuously record a final random bit sequence of 
1 Gbit, which passed three standard random tests, i.e., 
ENT [2ll, Diehard [H and STS [23]. The ENT results 
are: Entropy = 1.000000 bit per bit (the optimum com- 
pression would reduce the bit file by 0%). \ 2 distribution 
is 0.53 (randomly would exceed this value by 46.62% of 
the times). Arithmetic mean value of data bits is 0.5000. 
Monte Carlo value for ir is 3.141725650. Serial correla- 
tion coefficient is -0.000017. The Diehard and STS test 
results are shown in Tables I and II, respectively. 

It should be noted that, for a nonuniform distribution 
of the probability of 256 8-bit binary derivatives, if more 
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TABLE II: Results of NIST statistical test suite. Using 1000 
samples of 1 Mbits data and significance level a = 0.01, 
for "Success", the P- value (uniformity of p- values) should 
be larger than 0.0001 and the proportion should be greater 
than 0.9805608 For the tests which produce multiple P- 
values and proportions, the worst case is shown. As advised 
by NIST, the Fast Fourier Transform test is disregarded [24| . 



statistical test 


_r-value 


Proportion Result 


Frequency 


0.679846 


0.9916 


Success 


Block frequency 


0.248571 


0.9897 


Success 


Cumulative sums 


0.858032 


0.9888 


Success 


Runs 


0.816029 


0.9907 


Success 


Longest run 


0.648795 


0.9935 


Success 


Rank 


0.609895 


0.9860 


Success 


Nonperiodic 


0.569334 


0.9823 


Success 


Overlapping 


0.565500 


0.9916 


Success 


Universal 


0.143336 


0.9888 


Success 


Approximate 


0.590520 


0.9879 


Success 


Random excursions 


0.016388 


0.9880 


Success 


Random variant 


0.029796 


0.9865 


Success 


Serial 


0.946683 


0.9916 


Success 


Linear complexity 


0.732979 


0.9915 


Success 



than 1 bit are extracted from each 8-bit binary deriva- 
tives in order to improve the random bit generation rate 
(see, e.g., 5 LSBs are adopted in (l4|), an additive corre- 
lation in the final random bit sequence will be introduced, 
even though this additive correlation is not so significant 
to fail the random tests. Taking 5 LSBs for an instance, 
every set of the 5 LSBs possesses a different probability 
(due to the nonuniform distribution) and thus these 5 bits 
from the same set are correlated to some extent. How- 
ever, with this additive correlation within the same set, 
both the random bit sequence of extracting 5 LSBs (with 
the sampling rate of 2.5 GHz in [l4j]) and 4 LSBs (with 
the sampling rate of 40 MHz in our case) from an 8-bit 
binary number both successfully pass the three standard 
random tests. This fact also indicates that the standard 
random tests are only a way to examine whether the ran- 
dom bit stream is "sufficiently" random, but not to judge 
whether it is truly random. 

We propose a new and simple approach to realize a 
high-speed TRNG, which is compact and convenient to 
implement. The randomness of our TRNG is physically 
guaranteed by the intrinsic random nature of the quan- 
tum phase noise originated from the spontaneous emis- 
sion of photons. Moreover, for the first time, the true 
randomness is verified by both the statistical bias and 
the correlation coefficient for long random bit sequence 
up to 14 Gbit. Note that, the long random bit sequence is 
even more important than generation rate, because it is 
the length of the random bit sequence that is required in 
most applications and essentially, it is a metric for qual- 



ifying the true randomness. Compared to the chaotic 
laser, the intrinsic phase noise of a free-running laser is 
confirmed in true randomness, which only depends on its 
inherent quantum mechanical properties and does not 
need the external optical feedback to laser thereby intro- 
ducing photon round trip period. Although the random 
bit generation rate is not as high as that of chaotic laser 
scheme 13, 3], its physically guaranteed true random- 



ness and high generation rate, together with its simplicity 
and compactness, are attractive for applications which 
need true randomness. Also, a higher generation rate is 
attainable using a laser with larger linewidth and faster 
data acquisition hardware. 
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